Terminal Security: Requirements for a Secure Identity
A draft discussion document

Charles Brookson 27 October 1999
DTI UK

1 Background
This document explains why it is necessary to have an authentic terminal identity available to the regulator, manufacturer, operator and customer. It was requested by 3GPP SA WG3 to provide some of the requirements for a secure identity (Apparently I am so ancient I can recollect some of the arguments over the last 12 years!).

The IMEI was introduced into GSM at first for type approval reasons, so that out of specification terminals may be removed from a network. Subsequently, the identities of stolen mobiles were used to stop them from working on a network. This introduced an incentive for criminals to change the terminal identity (in order to allow the mobiles back on to a network).

In general, almost without exception in GSM, terminals can have their identity easily changed. Most manufacturers build a trapdoor into the mobile so that the identity can easily be changed for servicing and maintenance reasons, and these trapdoors usually leak out within a few months. Information is available around the Internet on the changing of identities of most models of GSM mobiles.

Many operators have reported large numbers of mobiles with identical identities to the GSM Association Fraud Group. In some cases a few thousand terminals. I have seen mobiles on a GSM 1800 network, which claim to be GSM 900 network mobiles for example.

2 Requirements for security
For the Regulator
•	The terminal identity allows only type approved mobiles to be used on networks (in some countries, such as Denmark, this is a Telecommunications Licence obligation).
•	The identity allows a mobile to be identified for the purposes of lawful interception, and helps in criminal prosecution.

For the manufacturer
•	The identity helps identify terminals, which may be part of the Grey market in mobile phones that may have been subject to unauthorised export and import. This will allow servicing and support to be more easily managed.
•	The identity allows manufacturers to identify which mobiles may need software updates over the network, and allows updates to be downloaded to the correct mobiles (if not, the wrong mobiles will have the software updated, which may lead to problems).
•	The identity allows operators to be able to recall mobiles on behalf of manufacturers should they prove to be out of specification or even dangerous.
•	The identity allows manufacturers to have operators introduce special functions into the network to support mobiles that may not work correctly, such as has been done in the cases of frequency hopping or DTX in GSM.
•	The identity allows manufacturer to discourage theft in their production and delivery processes and reduce crime.
•	The identity helps identify which added value services are supported by the mobile, such as MExE or Java or other enhanced future functions, and then allows operators to handle them correctly, preventing potential customer support questions to manufacturers.

For the operator
•	The identity allows mobiles to be identified to allow added value services and enhanced functions to be run on a mobile.
•	The identity allows market research to be performed on the user base to identify which mobiles are used by which customers.
•	The identity allows an operator to determine which mobiles may be responsible for technical problems on a network, for example dropped calls or handover problems.
•	The identity allows the operators to identify possible fraud problems, such as a user with multiple subscriptions. Identity is often used in Fraud Detection Systems to such monitor handset activity.
•	The identity is often used in criminal trials to prove possession of a mobile terminal (as well as the subscription and customer identity with the SIM).
•	The lack of identity integrity within GSM has lead to the failure of the Equipment Identity Register (it is only supported by a few operators, about 30 of 400) and minimises the circulation of stolen handsets, increasing the effect of crime.
•	The terminal identity is used to prevent stolen mobiles from being re-used on networks to prevent crime, which may have great consequential problems (for example car theft and insurance) and social impact.

For the Customer
•	The identity allows a customer to check if a terminal has been stolen (some operators allow customers to check by telephone or Internet if a mobile has been stolen).
•	The identity allows a customer to prove purchase for warranty purposes.

3 Conclusions
For the above reasons:
Terminals should have identities
•	Identities should not easily be changed within the terminal
•	Identities should be passed with integrity checking to entities that require the identity, for example:
•	The customer
•	The operator and other third parties (banks, e-commerce etc.)